LastRewardRound is sometimes not checkpointed for Delegators

Lines of code Vulnerability details Impact lastRewardRound is not updated/checkpointed for delegators when transcoder changes state. This results in incorrect rewards and votes. It also violates this checkpointing condition specified by the technical specification: Quote: "In practical terms, it...

The order of decreasing total stake for the old delegate and increasing for the new delegate could lead to issues if one reverts but not the other.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept The potential issue is: decreaseTotalStake succeeds in decreasing the old delegate's stake increaseTotalStake reverts and does not increase the new delegate's stake This would incorrect...

PT-2023-6899

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0 Description The issue is related to an improper default REST API permission for Gamma users in Apache Superset, which is connected to shortcomings in the authorization mechanism. This allows a...

Potential Over-redemption Vulnerability in redeem Function

Lines of code Vulnerability details Impact In the redeem function, when a third party is using their allowance to redeem shares on behalf of an owner, there exists a potential scenario where the third party could redeem more than originally intended by the owner. Proof of Concept This is how the...

ERRORNEOUS RETURN VALUE PROVIDED BY THE UniV2LiquidityAmo.getLpTokenBalanceInWeth FUNCTION DUE TO PRECISION ERROR

Lines of code Vulnerability details Impact The UniV2LiquidityAmo.getLpTokenBalanceInWeth function is used to return the LP token balance of the contract in weth. It calls the getLpPrice function which is expected to return the LP price in 1e8 precision. getLpPrice function calls the...

missing in calculation parameter issue in Earnings Pool

Lines of code Vulnerability details Impact here is the vulnerable part in code : function getLastTranscoderRewardsEarningsPooladdress transcoder, uint256 round internal view returns uint256 rewardRound, EarningsPool.Data memory pool BondingCheckpoint storage bond = getBondingCheckpointAttranscode...

Overwriting rdpxAmount Without Checks

Lines of code Vulnerability details Impact The decreaseAmount function, specifically the line bondsbondId.rdpxAmount = amount;. This vulnerability allows overwriting the rdpxAmount without any checks or backups, which can result in irreversible data loss. function decreaseAmount uint256 bondId,...

DOS the system by frontrunning the initialize function

Lines of code Vulnerability details Impact LivepeerGovernor and Treasury are vulnerable to DOS. Proof of Concept The initialize function present in these two contracts is not called just after their construction. Which is confirmed in the contract LivepeerGovernorUpgradeMock.sol while initializin...

An attacker can manipulate the total active stake before calling reward() to get more rewards

Lines of code Vulnerability details Impact Attackers could drain rewards meant for other transcoders. Proof of Concept The key vulnerable code is in the reward function: This uses the transcoder's total stake earningsPool.totalStake and the total active stake currentRoundTotalActiveStake to...

Slashing transcoders on violation should not effect the delegators who staked into such transcoders, delegators should continue to earn rewards

Lines of code Vulnerability details Impact Due to violation of norms, when a transcoder is slashed and force to resign, the delegators who provided stake into such transcoder should not be effected. They delegators should be able to continue earning the rewards as they delegated their tokens to...

using increaseTotalStakeUncheckpointed() instead of increaseTotalStake() can lead to inconsistent transcoder state

Lines of code Vulnerability details Impact This allows a transcoder to increase their voting power without actually increasing their stake. Proof of Concept The relevant code that uses increaseTotalStakeUncheckpointed and skips transcoder state checkpointing is in the updateTranscoderWithRewards...

Increasing Stake records the delegated amount for delegator, but does not update the earningsPool stake for transcoder resulting in loss of rewards

Lines of code Vulnerability details Impact IncreaseTotalStakeUncheckedPoint function updates the delegated amount, but could may not update the staked amount for the transcoder. This will impact the rewards calculation for transcoder and delegators. Proof of Concept When the TotalStake is...

Attacker can steal funding yield from the PerpetualAtlanticVaultLP contract atomically

Lines of code Vulnerability details Impact An attacker is able to atomically steal large amounts of the funding yield from the PerpetualAtlanticVaultLP contract. This is due to the fact that the deposit function of the PerpetualAtlanticVaultLP contract will first issue the attacker shares based o...

Approve race condition when calling approveContractToSpend()

Lines of code Vulnerability details Impact Malicious allowance spenders will be able to spend more than the protocol intended. Proof of Concept When modifying the approved allowance of a spender address there is an issue with the spender address front-running the modification transaction and...

Missed approving to UniswapV2Router

Lines of code Vulnerability details Impact The contract should have already granted an allowance of at least minamountOfWeth for the input token. This step is missing during the UniswapV2Router call within the lowerDepeg function. // @audit msg.sender should have already given the router an...

arbitrum block.number refers to L1 block number, not L2 block number when determining the round

Lines of code Vulnerability details Impact arbitrum block.number refers to L1 block number, not L2 block number Proof of Concept In the current implementation, the round manager use block.number to determine the round However, according to the block.number in arbitrum refers to ethereum mainnet...

When user unbonds before transcoder calls reward, then cumulativeRewardFactor for the round is less than it should be

Lines of code Vulnerability details Impact When user unbonds before transcoder calls reward, then cumulativeRewardFactor for the round is less than it should be. As result other delegators loose rewards. Proof of Concept Each round transcoder can call reward function in order to claim reward toke...

You can front-run to enrich yourself

Lines of code Vulnerability details Impact An attacker can use flash loan and withdraw significant part of funding intended for collateral providers. Proof of Concept Let's consider code snippet from deposit: requireshares = previewDepositassets != 0, "ZEROSHARES";...

Lack of Input Validation and Error Handling

Lines of code Vulnerability details Impact In the slashTranscoder function, the parameters slashAmount and finderFee are directly used for computation without any validity checks. This design overlooks several key issues: There's no check to see if slashAmount or finderFee are within logical...

Unprotected initialize functions can front-run by MEV or by an Attacker

Lines of code Vulnerability details Vulnerability Detail It should be avoided that the implementation of proxy contracts can be initialized by third parties. This can be the case if the initialize function is unprotected. Since the implementation contract is not meant to be used directly without ...